A critical problem in the cube attack is how to recover superpolies efficiently.As the targeting number of rounds of an iterative stream cipher increases,the scale of its superpolies becomes larger and larger.Recently...A critical problem in the cube attack is how to recover superpolies efficiently.As the targeting number of rounds of an iterative stream cipher increases,the scale of its superpolies becomes larger and larger.Recently,to recover massive superpolies,the nested monomial prediction technique,the algorithm based on the divide-and-conquer strategy,and stretching cube attacks were proposed,which have been used to recover a superpoly with over ten million monomials for the NFSR-based stream ciphers such as Trivium and Grain-128AEAD.Nevertheless,when these methods are used to recover superpolies,many invalid calculations are performed,which makes recovering superpolies more difficult.This study finds an interesting observation that can be used to improve the above methods.Based on the observation,a new method is proposed to avoid a part of invalid calculations during the process of recovering superpolies.Then,the new method is applied to the nested monomial prediction technique and an improved superpoly recovery framework is presented.To verify the effectiveness of the proposed scheme,the improved framework is applied to 844-and 846-round Trivium and the exact ANFs of the superpolies is obtained with over one hundred million monomials,showing the improved superpoly recovery technique is powerful.Besides,extensive experiments on other scaled-down variants of NFSR-based stream ciphers show that the proposed scheme indeed could be more efficient on the superpoly recovery against NFSR-based stream ciphers.展开更多
为深入分析恶意代码高层行为之间的逻辑关系,剖析恶意代码的工作机制,针对现有的基于语义的行为分析方法无法进一步抽象出更高层语义行为以及挖掘之间逻辑关系的缺陷,文中以行为事件为研究对象,提出了一种基于语义分析的恶意代码攻击图...为深入分析恶意代码高层行为之间的逻辑关系,剖析恶意代码的工作机制,针对现有的基于语义的行为分析方法无法进一步抽象出更高层语义行为以及挖掘之间逻辑关系的缺陷,文中以行为事件为研究对象,提出了一种基于语义分析的恶意代码攻击图生成方法。首先,借助MITRE ATT&CK模型,设计了一种新的恶意代码行为分析模型——m-ATT&CK(Malware-Adversarial Tactics,Techniques,and Common Knowledges),该模型由恶意代码、行为事件、攻击战术及其之间的联系构成;然后,提出了基于F-MWTO(Fuzzy Method of Window Then Occurrence)的近似模式匹配行为映射算法,实现了恶意代码行为信息到m-ATT&CK模型的映射,并构建了隐马尔可夫模型挖掘攻击战术序列;最后,定义了恶意代码语义级攻击图并设计了其生成算法,结合已识别出的行为事件,还原恶意代码高层行为的上下文语义信息,生成恶意代码语义级攻击图。实验结果表明,基于以上方法得到的语义级攻击图能够清晰地展现恶意代码的工作机制以及攻击意图。展开更多
由于工业控制系统(industrial control system,ICS)与物理环境紧密联系,其特有的序列攻击可通过将合法的操作注入到操作序列中的不合理位置上,迫使ICS进入异常状态,损毁设备,甚至破坏生态环境.目前,针对序列攻击检测的研究基本上是从信...由于工业控制系统(industrial control system,ICS)与物理环境紧密联系,其特有的序列攻击可通过将合法的操作注入到操作序列中的不合理位置上,迫使ICS进入异常状态,损毁设备,甚至破坏生态环境.目前,针对序列攻击检测的研究基本上是从信息流中提取操作序列进行检测,易受错误、虚假数据等情况的影响,导致检测精度受到限制.针对该问题,充分考虑ICS的操作与物理环境的相互依赖性,提出一种双流融合的工业控制异常检测机制,从物理环境中实时提取工业控制设备的状态信息组成设备状态流,并将其与信息流相融合,从操作次序和时序2个维度检测操作序列是否正常.同时利用设备状态流信息识别操作间隔中的工业控制设备的异常状态,提升异常检测范围和对操作时序异常的检测精度.实验结果表明:该方法能有效地识别序列攻击和部分工业控制设备的异常状态.展开更多
基金National Natural Science Foundation of China(62372464)。
文摘A critical problem in the cube attack is how to recover superpolies efficiently.As the targeting number of rounds of an iterative stream cipher increases,the scale of its superpolies becomes larger and larger.Recently,to recover massive superpolies,the nested monomial prediction technique,the algorithm based on the divide-and-conquer strategy,and stretching cube attacks were proposed,which have been used to recover a superpoly with over ten million monomials for the NFSR-based stream ciphers such as Trivium and Grain-128AEAD.Nevertheless,when these methods are used to recover superpolies,many invalid calculations are performed,which makes recovering superpolies more difficult.This study finds an interesting observation that can be used to improve the above methods.Based on the observation,a new method is proposed to avoid a part of invalid calculations during the process of recovering superpolies.Then,the new method is applied to the nested monomial prediction technique and an improved superpoly recovery framework is presented.To verify the effectiveness of the proposed scheme,the improved framework is applied to 844-and 846-round Trivium and the exact ANFs of the superpolies is obtained with over one hundred million monomials,showing the improved superpoly recovery technique is powerful.Besides,extensive experiments on other scaled-down variants of NFSR-based stream ciphers show that the proposed scheme indeed could be more efficient on the superpoly recovery against NFSR-based stream ciphers.
文摘为深入分析恶意代码高层行为之间的逻辑关系,剖析恶意代码的工作机制,针对现有的基于语义的行为分析方法无法进一步抽象出更高层语义行为以及挖掘之间逻辑关系的缺陷,文中以行为事件为研究对象,提出了一种基于语义分析的恶意代码攻击图生成方法。首先,借助MITRE ATT&CK模型,设计了一种新的恶意代码行为分析模型——m-ATT&CK(Malware-Adversarial Tactics,Techniques,and Common Knowledges),该模型由恶意代码、行为事件、攻击战术及其之间的联系构成;然后,提出了基于F-MWTO(Fuzzy Method of Window Then Occurrence)的近似模式匹配行为映射算法,实现了恶意代码行为信息到m-ATT&CK模型的映射,并构建了隐马尔可夫模型挖掘攻击战术序列;最后,定义了恶意代码语义级攻击图并设计了其生成算法,结合已识别出的行为事件,还原恶意代码高层行为的上下文语义信息,生成恶意代码语义级攻击图。实验结果表明,基于以上方法得到的语义级攻击图能够清晰地展现恶意代码的工作机制以及攻击意图。
文摘由于工业控制系统(industrial control system,ICS)与物理环境紧密联系,其特有的序列攻击可通过将合法的操作注入到操作序列中的不合理位置上,迫使ICS进入异常状态,损毁设备,甚至破坏生态环境.目前,针对序列攻击检测的研究基本上是从信息流中提取操作序列进行检测,易受错误、虚假数据等情况的影响,导致检测精度受到限制.针对该问题,充分考虑ICS的操作与物理环境的相互依赖性,提出一种双流融合的工业控制异常检测机制,从物理环境中实时提取工业控制设备的状态信息组成设备状态流,并将其与信息流相融合,从操作次序和时序2个维度检测操作序列是否正常.同时利用设备状态流信息识别操作间隔中的工业控制设备的异常状态,提升异常检测范围和对操作时序异常的检测精度.实验结果表明:该方法能有效地识别序列攻击和部分工业控制设备的异常状态.
